[mckaragoz]

Title: Fix open redirect validation in authentication flows

Description:

Summary

• Reject ambiguous and unsafe return URL paths.
• Require explicit allowed origins for absolute redirect URLs.
• Preserve existing relative redirect behavior and default DX.
• Add regression tests for unsafe paths and unauthorized redirects.

Security

Prevents untrusted external redirect targets from being accepted when AllowedClientOrigins is empty.

Compatibility

No new configuration is required for applications using relative return URLs.

[codecov]

Codecov Report

❌ Patch coverage is 90.90909% with 1 line in your changes missing coverage. Please review.
✅ Project coverage is 87.22%. Comparing base (7a5ba4b) to head (1daf1db).
⚠️ Report is 2 commits behind head on dev.

Files with missing lines	Patch %	Lines
....Server/Infrastructure/Redirect/ReturnUrlParser.cs	87.50%	0 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##              dev     #158      +/-   ##
==========================================
+ Coverage   87.20%   87.22%   +0.01%     
==========================================
  Files         580      580              
  Lines       18915    18919       +4     
  Branches     2228     2228              
==========================================
+ Hits        16495    16502       +7     
+ Misses       1617     1615       -2     
+ Partials      803      802       -1     

Flag	Coverage Δ
framework	87.22% <90.90%> (+0.01%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.